CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-43667

creationtimestamp| type| source ---|---|--- 2026-08-18 04:45:42+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818 2026-08-18 08:45:41+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2020...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

EUVD-2026-60544

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

EUVD-2026-60551

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components...

PT-2026-77476

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites version 12.2.1.4.0 Oracle WebCenter Sites version 14.1.2.0.0 Description A flaw in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to...

CVE-2026-52608

reportico-web versions up to 8.1.0 have an incorrect access control flaw allowing unauthenticated attackers to inject arbitrary PHP into any report's PreExecuteCode attribute, bypassing safe_mode, leading to remote code execution. No patch version or in-the-wild exploitation details are provided ...

PT-2026-77327

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A use after free issue in the Browser component on Mac allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to enti...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-78063

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.18 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full...

PT-2026-77945

Name of the Vulnerable Software and Affected Versions Oracle Commerce Platform version 11.4.0 Description A flaw in the Dynamo Application Framework component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...

PT-2026-77782

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

PT-2026-76927

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error log function through a data directive...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox E...

PT-2026-78030

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A flaw in the Application Server component of the Oracle Agile PLM product allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

EUVD-2026-61145

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...